Jazzy2Fives

In WordPress, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public. This issue is related to the comment-template.php file in the wp-includes directory.

The issue is related to an unintended/open redirect when an arbitrary external link is crafted due to a problem in `wp validate redirect()` and URL sanitization. This could allow a remote attacker to access and compromise confidential data.

The issue is related to the injection of JavaScript into media file attachment pages by authenticated users with upload permissions, such as authors. This can lead to script execution in the context of a higher privileged user when the file is viewed by them.

The issue is related to the embed block in the WordPress block editor, which allows users with low privileges to inject unfiltered HTML. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.